From e75bd2f3ef4b75a904b3cc20599defbe7d05ff5d Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Thu, 6 Jun 2019 17:04:17 +0100 Subject: [PATCH] Fix ECDSA certificate issuance with ACME issuer Signed-off-by: James Munnelly --- pkg/issuer/acme/issue.go | 4 ++-- .../issuers/acme/certificate/BUILD.bazel | 1 + .../issuers/acme/certificate/http01_new.go | 20 +++++++++++++++++++ 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/pkg/issuer/acme/issue.go b/pkg/issuer/acme/issue.go index 90a9a6574..ccd30ede1 100644 --- a/pkg/issuer/acme/issue.go +++ b/pkg/issuer/acme/issue.go @@ -294,12 +294,12 @@ func (a *Acme) getCertificatePrivateKey(ctx context.Context, crt *v1alpha1.Certi log.V(4).Info("Generating new private key") // generate a new private key. - rsaKey, err := pki.GenerateRSAPrivateKey(2048) + privateKey, err := pki.GeneratePrivateKeyForCertificate(crt) if err != nil { return nil, false, err } - return rsaKey, true, nil + return privateKey, true, nil } func (a *Acme) createNewOrder(ctx context.Context, crt *v1alpha1.Certificate, template *v1alpha1.Order, key crypto.Signer) error { diff --git a/test/e2e/suite/issuers/acme/certificate/BUILD.bazel b/test/e2e/suite/issuers/acme/certificate/BUILD.bazel index e97ce1757..6b28ab590 100644 --- a/test/e2e/suite/issuers/acme/certificate/BUILD.bazel +++ b/test/e2e/suite/issuers/acme/certificate/BUILD.bazel @@ -24,6 +24,7 @@ go_library( "//test/e2e/framework/matcher:go_default_library", "//test/e2e/suite/issuers/acme/dnsproviders:go_default_library", "//test/e2e/util:go_default_library", + "//test/unit/gen:go_default_library", "//test/util/generate:go_default_library", "//vendor/github.com/onsi/ginkgo:go_default_library", "//vendor/github.com/onsi/gomega:go_default_library", diff --git a/test/e2e/suite/issuers/acme/certificate/http01_new.go b/test/e2e/suite/issuers/acme/certificate/http01_new.go index 6d63d6d50..8000e43de 100644 --- a/test/e2e/suite/issuers/acme/certificate/http01_new.go +++ b/test/e2e/suite/issuers/acme/certificate/http01_new.go @@ -38,6 +38,7 @@ import ( "github.com/jetstack/cert-manager/test/e2e/framework/log" . "github.com/jetstack/cert-manager/test/e2e/framework/matcher" "github.com/jetstack/cert-manager/test/e2e/util" + "github.com/jetstack/cert-manager/test/unit/gen" "github.com/jetstack/cert-manager/test/util/generate" ) @@ -158,6 +159,25 @@ var _ = framework.CertManagerDescribe("ACME Certificate (HTTP01)", func() { Expect(err).NotTo(HaveOccurred()) }) + It("should obtain a signed ecdsa certificate with a single CN from the ACME server", func() { + certClient := f.CertManagerClientSet.CertmanagerV1alpha1().Certificates(f.Namespace.Name) + + By("Creating a Certificate") + cert := gen.Certificate(certificateName, + gen.SetCertificateSecretName(certificateSecretName), + gen.SetCertificateIssuer(v1alpha1.ObjectReference{ + Name: issuerName, + }), + gen.SetCertificateDNSNames(acmeIngressDomain), + gen.SetCertificateKeyAlgorithm(v1alpha1.ECDSAKeyAlgorithm), + ) + _, err := certClient.Create(cert) + Expect(err).NotTo(HaveOccurred()) + By("Verifying the Certificate is valid and of type ECDSA") + err = h.WaitCertificateIssuedValid(f.Namespace.Name, certificateName, time.Minute*5) + Expect(err).NotTo(HaveOccurred()) + }) + It("should obtain a signed certificate for a long domain using http01 validation", func() { certClient := f.CertManagerClientSet.CertmanagerV1alpha1().Certificates(f.Namespace.Name)